Splunk Search

Using single column Holiday table how do I determine whether today is a holiday?

pm771
Communicator

I have a lookup CSV table that lists dates of holidays in a single column.

HolidayTable.csv:

HDate
1/1/2020
...................

 

I tried to use the following:

 

 

 

search ...
| eval currentdate=strftime(now(),"%-m/%-d/%Y") 
| lookup HolidayTable.csv HDate as currentdate OUTPUT HDate as Holiday
| eval Holiday=if(isnull(Holiday), "N", "Y")

 

 

 

My expectation was that when the current date matches a row in the table I will get the date  string and otherwise - null.

It does not seem to work this way.

What am I missing here?

 

Labels (1)
0 Karma
1 Solution

pm771
Communicator

[Following up with my own solution]

I ended up with creating a dummy 2nd column.

HDateOff
1/1/2020Y
...................Y

 

And with a slight change (used new column as returned value) my code started working:

 

 

 

search ...
| eval currentdate=strftime(now(),"%-m/%-d/%Y") 
| lookup HolidayTable.csv HDate as currentdate OUTPUT Off as Holiday
| eval Holiday=if(isnull(Holiday), "N", "Y")

 

 

 

 

View solution in original post

0 Karma

pm771
Communicator

[Following up with my own solution]

I ended up with creating a dummy 2nd column.

HDateOff
1/1/2020Y
...................Y

 

And with a slight change (used new column as returned value) my code started working:

 

 

 

search ...
| eval currentdate=strftime(now(),"%-m/%-d/%Y") 
| lookup HolidayTable.csv HDate as currentdate OUTPUT Off as Holiday
| eval Holiday=if(isnull(Holiday), "N", "Y")

 

 

 

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Your currentdate date format is wrong based on your example of 01/01/2020 in the CSV. Your format is

%-m/%-d

but it should be %m/%s, so it has leading zeros

 

0 Karma

pm771
Communicator

It was a typo in my question. Month and day in my table are without leading zeroes.

Since the table is going to be maintained via Excel, I had to use the default date format.

I will update the question.

0 Karma
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...